Also, I have to wonder what else you may do with this technology. Will you start alerting users to other things as well, such as high bandwidth usage, new services available, service outages, etc? While using this banner technology for stopping malware is a good thing, I can think of quite a few ways off the top of my head that something like this could be abused, whether it be for advertising or something else. Are there any other plans right now besides using this to stop malware? If so, I would be curious to hear them.

I am beta testing browsers, specifically of Firefox Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729) - Build ID: 20090824101458. It might behoove you and your sites to not be so picky on the version. Especially when the redirection goes to a 404 page. I hate to think of what happens when Firefox puts out another fix/version.

It seems an ideal vector for phishing attacks once end users have become familiar with such notices.

How do users know that the warning is really from Comcast and not a malicious impersonation?

How do users know that a "warning" (a malicious impersonation they assume is real) is not from Comcast?

There are innumerable malicious websites on the internet that already display graphics that appear to be anti-virus programs telling you your computer is infected, only to get you to download their malicious software. Aren't those criminals going to take advantage your users trust and supply warnings identical to yours, except that it points them to malicious code? Especially when you're the largest residential ISP in the U.S.?

How are users that aren't knowledgeable enough to prevent themselves from getting infected in the first place going to know how to avoid the malicious impersonations of your "Constant Guard" service? Those are the people that need this service the most, but are most likely to be fooled by impersonations.

You could attempt to filter out impersonations with your proxies, but that can easily be worked around (https, obfuscate/encrypt it and use javascript to decode it in the browser, use images, etc). There have been browser vulnerabilities in the past that allow the address bar to display a different URL than the site you're actually visiting, and there's no guarantee similar vulnerabilities won't occur in the future.

Even if you went as far as allowing the user to setup an account for this, letting them choosing a special image and keyword to be displayed to them when the warning appears, similar to modern bank website logins, your warnings will be displayed on potentially malicious websites, which may have access to these things via javascript, and may upload that information to the malicious to store for later use.

Now I'm no security professional (though I do have a large interest in computer/network/info security and have been studying it a little for about 5 years), yet it seems as though there are numerous flaws to this system. This isn't just a notification system. This is a *security* notification system. Yet it seems that it is wide open to abuse by criminals. I wonder if you will unintentionally increase users' trust of malicious, "your computer may be infected", warnings, leading to more infected machines. In fact, as far as the client end is concerned, it appears that you are copying the techniques of criminals to inform them of their possible infections.

I glanced at the IETF draft for Service Notifications, and then only mention of "security" is that security considerations will be added in a future update of the draft (http://tools.ietf.org/html/draft-livingood-web-notification-00#section-11). Have any security experts been consulted while designing this system, or was security just an after-thought? I sure hope it wasn't an after-thought, since "Constant Guard" is in fact dealing directly with security issues. With the information I've seen about this so far, it appears it was initially designed with no thought of security whatsoever. I hope I'm wrong, and that you have already solved these problems (and any others I forgot to mention or haven't yet thought of).

My questions about the security of this system aside, I would much prefer this system to be at least opt-out, if not opt-in. I personally have no use for this system. At home I keep my machines and network locked down pretty well: run a linux router, use multiple linux machines, rarely use windows (though there is one windows machine on my network, with anti-virus, which I keep a careful eye on), watch traffic/connections, check logs, etc. I know it's not impossible for one of my machines to be compromised, which is why I'm always watching things. I certainly wouldn't trust this service enough to watch my machines/network any less than I currently do.

To help you verify the Service Notice is from Comcast, you should receive an email confirmation of this Service Notice to your Primary Comcast.net email account. Please click here to sign into your Comcast.net email.

The email will come from "csa-noreply@comcast.net" and will have a subject line of "Constant Guard Security Notice".
Noted below is a sample of the email sent to your Primary Comcast.net email account.


From: csa-noreply@comcast.net
Subject: Constant Guard Security Notice
Customer Security Assurance Notice
Dear Comcast Customer:
Constant Guard has identified that one or more of your computers may be infected by a computer virus known as a bot.
A bot is a form of virus that is used to gain control over a computer, typically without the owner’s knowledge. Online criminals can use bots to collect personal and private data such as Social Security numbers, bank account information, and/or credit card numbers. This can also lead to identity theft.
We recommend that you take a few minutes to visit the Anti-Virus Center for instructions to assist you in removing the virus from your computer. To help stay protected, we strongly advise you to perform regular Operating System and anti-virus software updates.
Comcast also makes extensive information available about the latest security alerts on the Comcast.net Web site. To view this information we urge customers to visit www.comcast.net/security .

Thank you for choosing Comcast!

Sincerely,
Customer Security Assurance
____________________________________________________

Thanks,
IT Support Los Angeles